Chapter 32 — Cryptography and trust services: interdisciplinary interfaces
Lesson map
Lesson 32 published. Map, example, EX094.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Law and policy"]
N2["32.2 Electronic signatures"]
N3["32.3 User experience"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX094"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Law and policy"]
N2["32.2 Electronic signatures"]
N3["32.3 User experience"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX094"]
[Learning outcomes]
|
v
[32.1 Law and policy]
|
v
[32.2 Electronic signatures]
|
v
[32.3 User experience]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX094]
Learning outcomes
You will (1) connect cryptographic decisions to law, policy and user experience; (2) explain electronic signatures in legal contexts; (3) design understandable security interactions.
32.1 Law and policy
Cryptographic decisions touch law. Data-protection law may require appropriate security for personal data, and encryption can reduce breach notification duties in some jurisdictions when keys remain safe. Electronic signature laws recognise different levels of signatures, and some contexts require qualified trust service providers. Priya studies Tidewell's obligations with the consortium's legal adviser and learns to phrase technical facts precisely so lawyers can map them to legal terms without misunderstanding. Priya keeps a short glossary for the adviser, defining terms such as key, certificate and signature in plain language.
32.2 Electronic signatures
Priya explains to the legal adviser that a digital signature is a cryptographic mechanism, while an electronic signature is a legal concept that may include typed names or scanned images. Publisher contracts use certificate-based digital signatures, which give stronger evidence of integrity and origin. She documents how long signed contracts must remain verifiable and recommends adding timestamps from a trusted timestamping service, so signatures can be validated even after the signing certificate expires. The adviser adds the timestamp requirement to the contract template.
32.3 User experience
Security interactions must be understandable. Priya redesigns the portal's login and recovery screens with a designer: clear wording on passphrases, an explanation of why one-time codes help and a recovery process that does not rely on easily guessed questions. She tests with ten volunteers, including older patrons, and revises unclear wording. She learns that confusing security leads users to unsafe workarounds, so usability is part of security, not its opponent. Two volunteers mention that the new wording finally explains why one-time codes are worth the extra step.
Worked example
Priya clarifies digital versus electronic signatures for the legal adviser, recommends trusted timestamps for long-term contract validation, and user-tests clearer login and recovery screens.
Synthetic case. Tidewell's legal context is invented; specific laws vary by jurisdiction.
Errors and limits
Legal requirements differ by jurisdiction; consult qualified advisers. Usability tests with few users find major issues but not all.
Exercises
- EX094 — Digital versus electronic. Distinguish a digital signature from an electronic signature. Rubric: 3 = digital is cryptographic mechanism; electronic is legal concept that can include typed names;; 2 = partial;; 1 = same;; 0 = none.
- EX095 — Timestamp purpose. Why add trusted timestamps to signed contracts? Rubric: 3 = so signatures can be validated after the signing certificate expires;; 2 = long-term;; 1 = vague;; 0 = none.
- EX096 — Usability link. Why is usability part of security? Rubric: 3 = confusing security drives unsafe workarounds;; 2 = workarounds;; 1 = unrelated;; 0 = none.
Synthesis
Cryptography meets law, policy and people; precise language and usable designs make it effective across disciplines.
Continue studying — chapter 32 of 40
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →